Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Analyzing Network Flow Data with Netflow · mukul975 | DecimalAI

Analyzing Network Flow Data With Netflow

SkillScore27Maintained

analyzing-network-flow-data-with-netflow

Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns. Uses the Python netflow library to decode flow records, builds traffic baselines, and applies statistical analysis to identify flows with abnormal byte counts, connection durations, and periodic timing patterns.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/analyzing-network-flow-data-with-netflow/SKILL.md

decimalai skills pull analyzing-network-flow-data-with-netflow --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/analyzing-network-flow-data-with-netflow/SKILL.md https://app.decimal.ai/s/analyzing-network-flow-data-with-netflow/SKILL.md

Raw file: /s/analyzing-network-flow-data-with-netflow/SKILL.md ↗ · machine-readable summary at /s/analyzing-network-flow-data-with-netflow.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

—-16% tokens0% turns27% of whole cases pass with skill (6/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-21	✗→✓	▲ Improved	—	—
case-08	✗→✓	▲ Improved	—	—
case-04	✗→✓	▲ Improved	—	—
case-09	✗→✓	▲ Improved	—	—
case-07	✗→✓	▲ Improved	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/analyzing-network-flow-data-with-netflow/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/1/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Analyzing Network Flow Data with Netflow

When to Use

When investigating security incidents that require analyzing network flow data with netflow
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Familiarity with network security concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Install dependencies: pip install netflow
Collect NetFlow/IPFIX data from routers or use the built-in collector: python -m netflow.collector -p 9995
Parse captured flow data using netflow.parse_packet().
Analyze flows for:

Port scanning: single source to many destinations on same port
Data exfiltration: high byte-count outbound flows to unusual destinations
C2 beaconing: periodic connections with consistent intervals
Volumetric anomalies: traffic spikes beyond baseline thresholds

Generate a prioritized findings report.

bash
python scripts/agent.py --flow-file captured_flows.json --output netflow_report.json

Examples

Parse NetFlow v9 Packet

python
import netflow
data, _ = netflow.parse_packet(raw_bytes, templates={})
for flow in data.flows:
    print(flow.IPV4_SRC_ADDR, flow.IPV4_DST_ADDR, flow.IN_BYTES)

Illustrative Want to see what analyzing-network-flow-data-with-netflow would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/27/2026, 23:47 UTC · 22 cases

Measured on 18 comparable cases — below the 22 needed to publish a lift, so this result is shown here but not on the registry card or leaderboard.

Lift

+27%

27% vs 0%

Agent turns

1.0 vs 1.0

Tokens

-16%

1,504.11 vs 1,781.39

fail → pass · 6fail → fail · 16

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-10 While reviewing network flow records, our SOC analyst wants to establish detection criteria for a port scan attack. How is a port scan pattern characterized when examining IP flow telemetry?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 How should an analyst identify Command and Control (C2) beaconing behavior purely from NetFlow summary records without payload inspection?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 How are volumetric traffic anomalies identified when analyzing flow records across network switch interfaces?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 What script relative path is invoked to execute the automated findings prioritization and report generation stage for flow datasets?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-03 I need to evaluate our router traffic logs for potential C2 channels and high-volume outbound transfers. Please process the captured flow file `router_capture.json` through the flow evaluation routine and save the resulting prioritized findings as `flow_report.json`.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 Our network monitoring system dumped a set of NetFlow records to `suspicious_flows.json`. Can you run a security analysis on this capture file to identify traffic anomalies and produce a prioritized findings document named `findings.json`?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 We are establishing a BGP peering session with an ISP (AS 65001). Write the router configuration snippet for a Cisco IOS router to advertise our network 203.0.113.0/24.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 Before executing local flow parsing and collector modules in Python for NetFlow analysis, what baseline Python version environment is required?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We captured recent flow logs during an incident investigation and saved them in `traffic_dump.json`. Please analyze this flow dataset for security threats such as port scans, exfiltration, or beaconing, and generate a prioritized report saved to `analysis_results.json`.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 When creating a detection rule for data exfiltration using network flow metrics, what specific flow characteristics indicate potential exfiltration?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 When performing automated flow analysis on router flow records, what four primary security threat categories should the flow analysis engine evaluate?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 I am setting up a fresh Python environment to parse and collect IPFIX/NetFlow records on Linux. What Python package management command installs the primary flow parsing dependency for this workflow?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We suspect a web application attack against our reverse proxy. Here is a raw PCAP file `web_traffic.pcap`. Can you perform full deep packet inspection on layer 7 HTTP headers and payload strings to extract SQL injection strings?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-15 When accessing the source IPv4 address from a parsed NetFlow v9 record object named `flow` using the `netflow` Python library, what standard field attribute name is accessed?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 When writing a custom Python parser for incoming NetFlow v9 binary packet bytes stored in variable `raw_bytes`, what exact function call from the `netflow` library should be invoked?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-18 Which built-in module path within the `netflow` Python package is executed to launch the flow telemetry collection server?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 When accessing the destination IPv4 address from a parsed flow record object in `netflow`, what field attribute name should be referenced?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 We need to block unauthorized traffic at the border gateway router. Please generate a set of Cisco ASA firewall access control list (ACL) commands to block IP address 192.0.2.45 from accessing port 443.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 We need to start a live NetFlow UDP listener daemon on port 9995 to capture incoming telemetry from core switches. What is the standard python module execution command to run this collector?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-14 In a Python script iterating through `data.flows` parsed by the `netflow` module, what specific attribute name holds the byte count in an IPv4 flow record?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 We have a batch export file `incident_flows.json` and want to execute the agent analysis script to generate a prioritized report `summary.json`. What command line options must be passed to `scripts/agent.py`?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-20 In NetFlow v9 parsing using `netflow.parse_packet`, what required dictionary parameter is passed alongside the raw bytes payload to handle template-based decoding?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 18 counted toward the lift figure. The other 4 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +27 percentage points is the difference between those two pass rates over the 18 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 0%
Pass rate with the skill: 27.3%
Cases attempted: 22
Cases counted toward lift: 18
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/27/2026, 23:47 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run27

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 54 days ago

Other measured skills in the registry, with their headline benchmark lift.